The most common justification for Tor is that people in countries like China that don't have full protections on free speech can use it to publish dissenting opinions or access foreign information. I don't understand how this protects them. Even though their governments cannot tell what information they're publishing etc, if the government is monitoring their internet connection they can still see if they are using Tor or not, and that is enough to compromise the dissident. So why is this considered a justification of Tor?
- It may be your English skills, but TOR does not need a justification. TOR was invented by the U.S. Naval Research Labs and the U.S. DARPA (see Wikipedia History) as a research project. However though part of the U.S. Military, they publicly released the concept and its code, then a non-profit (the TOR Project) continued to develop and expand it.
- TOR has many potential use-cases (not justifications). Since at a 10,000-foot level of abstraction, it is essentially a multi-hop VPN, its most trivial use-case is to use it in situations where a public and free VPN would be useful (such as when using a free and open WiFi in cafes, airports, and hotels), but no VPN is available. TOR is slower than a VPN, so its not an apples/oranges comparison of usefulness.
However, one of the stated project goals of TOR was to provide a level of anonymity of routing over the Internet (originally) from the client-side against a form of forensics/ investigation called "traffic analysis". The concept was that even though the Internet packets were in-the-clear once it left a TOR exit node, those packets could not be traced back to the client-side originator.
- So one possible use-case was that dissenters could use TOR to get past country-level firewalls to access foreign Internet resources. Or use TOR within a country, knowing the country would see the traffic past the TOR exit node, but could not determine who actually sent it. Of course that left the recipient of that traffic exposed.
- So TOR was extended to allow for "hidden services", such that in the dissenters use-case, an TOR email server could be setup as a "hidden service", and both parties use that email server via TOR to send and receive private emails between them. In that case the dissenters traffic never "leaves TOR", and the country never has an opportunity to see it in-the-clear.
However, both the original designers of TOR and the current sustainers of TOR really did not take into account what happens when the underlying network infrastructure of the Internet is totally eavesdroppable by country-level agencies. Even though the TOR Nodes fluctuate, agencies of various countries have "mapped the TOR nodes" and remap it continually using TOR's own tools.
- It is now possible for certain countries to know which clients and servers (by IP Address) have accessed a TOR entry node. Indeed, network logging by ISPs, companies, and organizations (in this example a university in the U.S.) allow them to also know when clients and servers within their networks access a TOR entry node.
- And of course, a country-level firewall can block all access to known TOR nodes that are outside their country, be they acting as entry, relay, or exit nodes.
- There are even more recent developments that again have weakened the effectiveness of TOR, at least against country-level agencies. These include Deanonymizing, bugs in TOR Browser, TOR Hidden Services malware, and more. However, the TOR Project is attempting to improve TOR to eliminate these new and advanced vulnerabilities.
- So TOR today is still a possible technology that dissenters could consider using. But like all technologies it has ever increasing risks in using it to achieve anonymity. However, those risks vary by country in which a dissenter resides, depending on the Internet sophistication of the country's intelligence and investigative agencies.
- If as in your question's scenario, the dissenter is already a "suspect" and his or her Internet connections are being eavesdropped upon already. So TOR is neither helping or hurting that dissenter's anonymity; the dissenter is already exposed.
- TOR would still offer confidentiality in the dissenter's use of the Internet, but so equally would a VPN, or using a web-site that uses TLS (though there are separate attacks against both VPNs and TLS).
- And given the malware the country may be able to inject onto the dissenter's computer, their use of TOR (or VPN or TLS) may only give the dissenter a false illusion of continued anonymity and confidentiality.
- And like that classic OPSEC tale of huge uptake of pizza deliveries to the Pentagon signals an imminent operation, indeed the use of TOR in particular (since it is not as common as TLS or VPN use) could trigger those monitoring authorities to assume the dissenter is actively up to no good.
TOR uses a set of proxies, relays and bridges to mask IP addresses. It also encrypts the connections between each relay with a 128 bit encryption, so it can be decent if I set myself to be a relay, for tor it would encrypt the ports it uses.
But it has to be used securely to be secure. Scripts that can decipher or decrypt live incoming traffic could just decrypt each node (relay) and find the traffic from there whether that be from another node or from the receiver's ISP. So they can monitor traffic feed but they would have to decrypt it when it's still live or if logs are present.